amordevolta[.]site

Analysis of amordevolta.site, created on February 21, 2026 and registered through Dynadot LLC, shows a clear brand‑impersonation campaign targeting TikTok. The site resolves to IP address 82.221.129.24, which belongs to AS50613 Advania Island ehf, indicating hosting in Iceland. No SSL certificate is present, meaning the site operated without HTTPS protection. The page title observed, "🎁 Ganhe Prêmios TikTok - Roleta Exclusiva," explicitly references TikTok and a prize‑wheel concept, reinforcing the impersonation intent.

VirusTotal scans report that nine of ninety‑five security vendors flagged the domain, suggesting malicious behavior recognized by a subset of scanners. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, confirming that at least one anti‑phishing service has taken remediation steps. Reputation metrics are mixed: Gridinsoft assigns a trust score of 0 / 100, while Scamadviser rates the domain at 49 / 100, reflecting low confidence in the site's legitimacy. Nameservers buffy.ns.orangewebsite.com and siti.ns.orangewebsite.com are associated with the registrar, providing no indication of additional infrastructure.

Current status is offline, so direct interaction is no longer possible, but historical evidence remains relevant for threat‑intel correlation. Uncertainties include the full scope of the phishing kit, any additional payloads, and whether the site ever served credential‑stealing forms; those details have not been captured in the available intelligence. Defenders should add 82.221.129.24 to network blocklists, monitor for future domains registered by the same registrar or using the same nameservers, and enforce strict URL filtering for TikTok‑related content. Continuous watch of VirusTotal and other sandbox feeds for re‑appearances of similar page titles or brand‑impersonation patterns is recommended.